External link > System card > GPT‑6

In this section, we provide results from our investigation into Astra's monitorability, that is, the extent to which we can expect monitoring systems to be able to detect when Astra acts in misaligned or otherwise undesirable ways. According to our evaluations, GPT-6 Astra shows a substantial decrease in chain-of-thought monitorability compared to previous models. Overall our alignment evaluations show that Astra is more likely than GPT-5.6 Sol to respect security and safety restrictions which make us confident in still deploying this model to the wider public.

Building on earlier initiatives that monitored employee Codex traffic for misalignment and many of our frontier RL training runs, we have now expanded our internal monitoring to cover all tool-using Astra traffic, including evaluations and training runs, as detailed in the above note on internal deployment of Astra. With this launch, we are expanding similar monitoring to cover the external deployment of Astra as well. You can read more about monitoring's role in Astra's external deployment in the monitoring part of our safeguards section below.

Monitorability evaluations

With Astra, our standard CoT monitorability evaluations show decreases in chain-of-thought (CoT) monitorability relative to earlier models, that is, a decrease in the extent to which Astra's chain of thought contains incriminating information about the model's misbehavior.

We provide monitorability results below under two kinds of conditions:

• Non-adversarial conditions, where we do not intervene to change the signals that a model gives to the monitors, and

• Adversarial conditions, where we do directly try to incentivize the model to evade monitoring.

In our evaluations, we evaluate GPT-6 Astra's monitorability using three types of monitor scope:

1. CoT-only monitor, which sees the inputs and the chain of thoughts only. Its recall rate measures the CoT monitorability of the model.

2. Action-only monitor, which sees the inputs, the outputs, the tool call actions and the tool call outputs. Its recall rate measures how transparent the models' actions are to the monitor.

3. Full-context monitor, which sees the inputs, chain of thoughts, tool call actions and outputs. This is the approach used in our production misalignment monitoring for Astra, and its recall rate measures the overall monitorability of our model.

For many types of severe misalignments, our evals indicate that highly destructive actions would be sufficiently incriminating for action-only monitoring to flag (i.e., without a CoT). However, action-only monitoring is not panacea: for some classes of subtle misbehaviors, benign actions and honest mistakes can be hard to distinguish from strategically misaligned actions. For example, if the model was strategically underperforming in AI safety research or in critical evaluations (a risk known as "sandbagging"), it would be difficult to tell conclusively whether the model's poor performance was intentional or actually reflective of a lack of capabilities when only having access to its actions. CoT generally gives us a window into the model's internal reasoning that could help address these questions.

Increased model capabilities with reasoning=None

When we prevent the model from reasoning, we observe the set of tasks Astra is able to accomplish without the use of CoT is greatly expanded compared to prior models (including tasks where reasoning cannot be displaced into tool calls or final output, such as tasks requiring an immediate numeric answer). See similar discussion in UK AISI evaluations, suggesting the no-CoT time horizon may have increased by about an order of magnitude. No-CoT ability is concerning for monitorability because it decreases the surface available to monitoring - effectively resulting in action-only monitoring - and allows the model to accomplish more complex misbehavior without verbalization. Note we do not currently have plans to make reasoning=None available.

Monitor evasion

We see Astra has an increased ability to evade our monitors when instructing it to do so. In one of our evaluations, we find that simply informing the model that a CoT monitor is present can result in the model disproportionately shortening its CoT, which enables it to occasionally evade CoT-only monitors. When prompted to do so, Astra seems to be able to strategically sandbag in evaluations in ways that evade sandbagging-specific monitors.

Our current evaluations indicate Astra is not able to perform steganographic CoT reasoning (i.e. concealing loadbearing hidden reasoning within ordinary and unrelated text) - which suggests that monitor evasion risk may be largely bounded to misalignment tasks that don't require CoT to complete successfully.

CoT controllability

We also found that GPT-6 Astra is significantly more able to control its own chain-of-thought. Controllability is an undesirable property for monitorability, because it reduces the trustworthiness of CoT for detecting model misalignment.

We are actively investigating the causes of GPT-6 Astra's increased CoT controllability. Unlike previous models, we find that CoT controllability for Astra especially increases over the course of RL training. We are fairly confident that there are no significant direct CoT grading pressures. We are also quite confident that changes in CoT controllability are not differentially due to any architectural changes. We have found that these changes are correlated with the increase in no-CoT capabilities (i.e., being able to take actions or return an answer without any verbalized reasoning required)

What this means for the future of monitorability

In general, for this type of large-scale external deployment, we view the main lever for avoiding misalignment harm as the underlying alignment of the model. There is no substitute for this. We consider the main value of misalignment monitoring to be providing increased visibility into frontier model misbehavior, as well as serving as an additional layer of protection. Broadly, CoT has been an important part of how we develop models and understand their misalignment.

We take very seriously the decrease in GPT-6 Astra's monitorability and what these results may imply for the future of monitorability. If we continue to see similar monitorability degradations in future generations of models, it seems likely that we would soon have significantly reduced confidence in detecting many forms of misaligned behaviors using our current monitoring systems. We are working on understanding our CoT controllability increases to see if they can be reverted in future runs, red-teaming ways in which we could defend against no-CoT misalignment capabilities, investigating alternatives to CoT monitoring (such as methods based on activation monitoring), and training schemes which encourage monitorability without incentivizing obfuscation. That said, there is real uncertainty as to whether these efforts will allow us to retain (and increase) confidence in the monitorability of our models as capabilities continue to increase.

We remain committed to maintaining monitorability; it's a key tool for understanding and tracking how model alignment generalizes out of training distribution. This need not be via CoT monitoring: it could also be via activation monitoring, confessions, or a combination of monitoring methods. We are tracking monitorability closely and will not accept further degradation of monitoring beyond a limit, without new ways to demonstrate alignment generalization. We plan to share more about our approach in the coming months.

At the moment, these findings are largely based on adversarial evaluations (e.g., when we instruct the model to evade monitoring), and overall our alignment evaluations show that Astra is more likely than GPT-5.6 Sol to respect security and safety restrictions which make us confident in still deploying this model to the wider public.